Merge pull request #40 from nzin/security_improvement

security improvement: just apply merged commits

.github/workflows/main.yaml

@@ -3,7 +3,7 @@ name: Build Docker Image on Tag
 on:
   create:
     tags:
-      - '*'
+      - 'v[0-9]+.[0-9]+.[0-9]+'
 
 permissions:
   packages: write

internal/engine/local.go

@@ -227,7 +227,11 @@ func (g *GoliacLocalImpl) ListCommitsFromTag(tagname string) ([]*object.Commit,
 		if c.Hash == refTag.Hash() {
 			return errors.New("stop iteration") // This is used to stop the iteration
 		}
-		commits = append(commits, c)
+		// filter for merge commits
+		// merge commits typically have two parents
+		if len(c.ParentHashes) > 1 {
+			commits = append(commits, c)
+		}
 
 		return nil
 	})

internal/goliac.go

@@ -141,7 +141,7 @@ func (g *GoliacImpl) ApplyToGithub(dryrun bool, teamreponame string, branch stri
 				ga := NewGithubBatchExecutor(g.remote, g.repoconfig.MaxChangesets)
 				reconciliator := engine.NewGoliacReconciliatorImpl(ga, g.repoconfig)
 
-				ctx := context.WithValue(context.TODO(), engine.KeyAuthor, commit.Author.Email)
+				ctx := context.WithValue(context.TODO(), engine.KeyAuthor, fmt.Sprintf("%s <%s>", commit.Author.Name, commit.Author.Email))
 				err = reconciliator.Reconciliate(ctx, g.local, g.remote, teamreponame, dryrun)
 				if err != nil {
 					return fmt.Errorf("Error when reconciliating: %v", err)